ECCouncil Computer Hacking Forensic Investigator CHIF V9 312-49v9 Exam Questions

Regina2021-11-02T05:54:18+00:00

By Regina CHFI, EC-Council, Free Questions Online 312-49v9, 312-49v9 demo, 312-49v9 exam questions, 312-49v9 free questions

Certified Hacking Forensic Investigator (CHFI) is the only comprehensive ANSI accredited, lab-focused program in the market that gives organizations vendor-neutral training in digital forensics. Earning ECCouncil Computer Hacking Forensic Investigator CHIF V9 certification is required to answer 312-49v9 exam successfully. 312-49v9 exam questions are newly updated by ITExamShop providing with 589 practice exam questions and answers, which are examined by highly qualified experts in IT industry, and then it is properly verified by our team for its higher validity. Choose the most valid EC-Council CHIF 312-40v9 exam questions as the preparation materials to pass ECCouncil Computer Hacking Forensic Investigator (V9) exam smoothly.

First, you can read EC-Council 312-49v9 free questions to check the quality.

Page 1 of 4

1. As a CHFI professional, which of the following is the most important to your professional reputation?

Your Certifications

The correct, successful management of each and every case

The free that you charge

The friendship of local law enforcement officers

2. If a suspect computer is located in an area that may have toxic chemicals, you must:

coordinate with the HAZMAT team

determine a way to obtain the suspect computer

assume the suspect machine is contaminated

do not enter alone

3. During the course of an investigation, you locate evidence that may prove the innocence of the suspect of the investigation. You must maintain an unbiased opinion and be objective in your entire fact finding process. Therefore, you report this evidence.

This type of evidence is known as:

Inculpatory evidence

Mandatory evidence

Exculpatory evidence

Terrible evidence

4. How many bits is Source Port Number in TCP Header packet?

5. You are working as an investigator for a corporation and you have just received instructions from your manager to assist in the collection of 15 hard drives that are part of an ongoing investigation.

Your job is to complete the required evidence custody forms to properly document each piece of evidence as it is collected by other members of your team. Your manager instructs you to complete one multi-evidence form for the entire case and a single-evidence form for each hard drive .

How will these forms be stored to help preserve the chain of custody of the case?

All forms should be placed in an approved secure container because they are now primary evidence in the case.

The multi-evidence form should be placed in the report file and the single-evidence forms should be kept with each hard drive in an approved secure container.

The multi-evidence form should be placed in an approved secure container with the hard drives and the single-evidence forms should be placed in the report file.

All forms should be placed in the report file because they are now primary evidence in the case.

6. You are trying to locate Microsoft Outlook Web Access Default Portal using Google search on the Internet .

What search string will you use to locate them?

allinurl:"exchange/logon.asp"

intitle:"exchange server"

locate:"logon page"

outlook:"search"

7. The use of warning banners helps a company avoid litigation by overcoming an employee assumed __________________________. When connecting to the company's intranet, network or Virtual Private Network (VPN) and will allow the company's investigators to monitor, search and retrieve information stored within the network.

Right to work

Right of free speech

Right to Internet Access

Right of Privacy

8. How many sectors will a 125 KB file use in a FAT32 file system?

256

9. What does the acronym POST mean as it relates to a PC?

Primary Operations Short Test

PowerOn Self Test

Pre Operational Situation Test

Primary Operating System Test

10. You work as a penetration tester for Hammond Security Consultants. You are currently working on a contract for the state government of California. Your next step is to initiate a DoS attack on their network .

Why would you want to initiate a DoS attack on a system you are testing?

Show outdated equipment so it can be replaced

List weak points on their network

Use attack as a launching point to penetrate deeper into the network

Demonstrate that no system can be protected against DoS attacks

Page 2 of 4

11. Your company uses Cisco routers exclusively throughout the network. After securing the routers to the best of your knowledge, an outside security firm is brought in to assess the network security.

Although they found very few issues, they were able to enumerate the model, OS version, and capabilities for all your Cisco routers with very little effort .

Which feature will you disable to eliminate the ability to enumerate this information on your Cisco routers?

Border Gateway Protocol

Cisco Discovery Protocol

Broadcast System Protocol

Simple Network Management Protocol

12. What will the following command accomplish?

Test ability of a router to handle over-sized packets

Test the ability of a router to handle under-sized packets

Test the ability of a WLAN to handle fragmented packets

Test the ability of a router to handle fragmented packets

13. James is testing the ability of his routers to withstand DoS attacks. James sends ICMP ECHO requests to the broadcast address of his network .

What type of DoS attack is James testing against his network?

Smurf

Trinoo

Fraggle

SYN flood

14. What type of attack occurs when an attacker can force a router to stop forwarding packets by flooding the router with many open connections simultaneously so that all the hosts behind the router are effectively disabled?

digital attack

denial of service

physical attack

ARP redirect

15. Kyle is performing the final testing of an application he developed for the accounting department.

His last round of testing is to ensure that the program is as secure as possible. Kyle runs the following command .

What is he testing at this point?

#include #include int main(int argc, char

*argv[]) { char buffer[10]; if (argc < 2) { fprintf (stderr, "USAGE: %s stringn", argv[0]); return 1; }

strcpy(buffer, argv[1]); return 0; }

Buffer overflow

SQL injection

Format string bug

Kernal injection

16. Bob has been trying to penetrate a remote production system for the past two weeks. This time however, he is able to get into the system. He was able to use the System for a period of three weeks. However, law enforcement agencies were recoding his every activity and this was later presented as evidence.

The organization had used a Virtual Environment to trap Bob .

What is a Virtual Environment?

A Honeypot that traps hackers

A system Using Trojaned commands

An environment set up after the user logs in

An environment set up before a user logs in

17. If you discover a criminal act while investigating a corporate policy abuse, it becomes a publicsector investigation and should be referred to law enforcement?

true

false

18. E-mail logs contain which of the following information to help you in your investigation? (Choose four.)

user account that was used to send the account

attachments sent with the e-mail message

unique message identifier

contents of the e-mail message

date and time the message was sent

19. As a security analyst, you setup a false survey website that will require users to create a username and a strong password. You send the link to all the employees of the company .

What information will you be able to gather?

The IP address of the employees’ computers

Bank account numbers and the corresponding routing numbers

The employees network usernames and passwords

The MAC address of the employees’ computers

20. One way to identify the presence of hidden partitions on a suspect's hard drive is to:

Add up the total size of all known partitions and compare it to the total size of the hard drive

Examine the FAT and identify hidden partitions by noting an H in the partition Type field

Examine the LILO and note an H in the partition Type field

It is not possible to have hidden partitions on a hard drive

Page 3 of 4

21. When reviewing web logs, you see an entry for resource not found in the HTTP status code filed.

What is the actual error code that you would see in the log for resource not found?

202

404

505

909

22. In conducting a computer abuse investigation you become aware that the suspect of the investigation is using ABC Company as his Internet Service Provider (ISP). You contact ISP and request that they provide you assistance with your investigation .

What assistance can the ISP provide?

The ISP can investigate anyone using their service and can provide you with assistance

The ISP can investigate computer abuse committed by their employees, but must preserve the privacy of their customers and therefore cannot assist you without a warrant

The ISP can't conduct any type of investigations on anyone and therefore can't assist you

ISP's never maintain log files so they would be of no use to your investigation

23. What information do you need to recover when searching a victim’s computer for a crime committed with specific e-mail message?

Internet service provider information

E-mail header

Username and password

Firewall log

24. 1.What does mactime, an essential part of the coroner's toolkit do?

It traverses the file system and produces a listing of all files based on the modification, access and change timestamps

It can recover deleted file space and search it for data. However, it does not allow the investigator to preview them

The tools scans for i-node information, which is used by other tools in the tool kit

It is too specific to the MAC OS and forms a core component of the toolkit

25. You are working for a local police department that services a population of 1,000,000 people and you have been given the task of building a computer forensics lab .

How many law-enforcement computer investigators should you request to staff the lab?

26. In what way do the procedures for dealing with evidence in a criminal case differ from the procedures for dealing with evidence in a civil case?

evidence must be handled in the same way regardless of the type of case

evidence procedures are not important unless you work for a law enforcement agency

evidence in a criminal case must be secured more tightly than in a civil case

evidence in a civil case must be secured more tightly than in a criminal case

27. You are assisting a Department of Defense contract company to become compliant with the stringent security policies set by the DoD. One such strict rule is that firewalls must only allow incoming connections that were first initiated by internal computers .

What type of firewall must you implement to abide by this policy?

Packet filtering firewall

Circuit-level proxy firewall

Application-level proxy firewall

Stateful firewall

28. To make sure the evidence you recover and analyze with computer forensics software can be admitted in court, you must test and validate the software .

What group is actively providing tools and creating procedures for testing and validating computer forensics software?

Computer Forensics Tools and Validation Committee (CFTVC)

Association of Computer Forensics Software Manufactures (ACFSM)

National Institute of Standards and Technology (NIST)

Society for Valid Forensics Tools and Testing (SVFTT)

29. Harold is a security analyst who has just run the rdisk /s command to grab the backup SAM files on a computer.

Where should Harold navigate on the computer to find the file?

%systemroot%system32LSA

%systemroot%system32driversetc

%systemroot%repair

%systemroot%LSA

30. The MD5 program is used to:

wipe magnetic media before recycling it

make directories on an evidence disk

view graphics files on an evidence drive

verify that a disk is not altered when you examine it

Page 4 of 4

31. When examining the log files from a Windows IIS Web Server, how often is a new log file created?

the same log is used at all times

a new log file is created everyday

a new log file is created each week

a new log is created each time the Web Server is started

32. You have been asked to investigate after a user has reported a threatening e-mail they have received from an external source .

Which of the following are you most interested in when trying to trace the source of the message?

The X509 Address

The SMTP reply Address

The E-mail Header

The Host Domain Name

33. Kimberly is studying to be an IT security analyst at a vocational school in her town. The school offers many different programming as well as networking languages .

What networking protocol language should she learn that routers utilize?

ATM

UDP

BPG

OSPF

34. Which of the following refers to the data that might still exist in a cluster even though the original file has been overwritten by another file?

Sector

Metadata

MFT

Slack Space

35. You should make at least how many bit-stream copies of a suspect drive?

Welcome To Choose Required IT Certification Exams Online

ECCouncil Computer Hacking Forensic Investigator CHIF V9 312-49v9 Exam Questions

First, you can read EC-Council 312-49v9 free questions to check the quality.

Author